The Agent Skills Directory

[SAFE]: The skill follows secret management best practices by utilizing environment variables (DOCUMENSO_API_KEY) for credential access rather than hardcoding sensitive API keys directly in the provided code templates.
[SAFE]: The logging implementation incorporates explicit security measures using the pino logger's redaction features to automatically remove sensitive fields such as apiKey, signingToken, and signingUrl from log output, preventing accidental exposure of credentials in monitoring stacks.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing external data from Documenso webhooks and API responses, which introduces a potential vulnerability surface.
Ingestion points: External data enters the application context via req.body in the Express webhook endpoint and via response objects from the Documenso SDK.
Boundary markers: The skill does not define explicit LLM prompt boundaries as it focuses on backend implementation code, but it uses structured JSON logging to maintain data separation.
Capability inventory: The implementation is limited to logging, metrics collection (Prometheus), and distributed tracing (OpenTelemetry), which are generally low-risk operations.
Sanitization: The skill includes a sanitizeParams function designed to strip sensitive fields and truncate large payloads before they are processed by the logging subsystem.

documenso-observability